States join spyware battle

Late on Wednesday, Utah apparently became the first state to pass a law regulating spyware and other advertising software, although the bill has yet to be signed by the governor. Lawmakers in Iowa and California also have introduced their own spyware control proposals in the past several weeks.

But while potentially welcome news for consumers, the legislative trend is raising worried eyebrows among some Internet businesses, which are concerned that state laws may unintentionally hamper some means of doing legitimate business on the Net.

"Our concerns are (about) regulating a technology rather than regulating the use of a technology," said Emily Hackett, executive director of the Internet Alliance, a trade organization that includes America Online, eBay and Microsoft and which opposed early drafts of the Utah legislation. "What's called spyware is not innately a bad thing. What's called a pop-up is not innately a bad thing."

The burgeoning state interest is a sign that spyware concerns are following much the same path taken by spam--from growing consumer irritation to a focus of public policy.

"Spyware" and "adware" are rarely clearly defined, but typically denote software that tracks computer users' actions online or uses a computer's resources to pop up advertisements or other messages. Many of these programs are bundled quietly with other pieces of software and are sometimes difficult or impossible to find and uninstall.

Federal lawmakers and regulators already are looking at the issue, with the latest congressional bill introduced last week aimed at blocking suspicious software from taking over computers. The Federal Trade Commission is planning a meeting on the issue next month.

The Utah bill, the most sweeping of the pieces of proposed legislation, arose from a problem reported by a local contact lens direct marketer, which discovered that some of its customers were seeing pop-up ads when visiting the company's Web site. Those ads were the result of advertising software on the customers' computers rather than the contact lens Web site, and the company contacted its local legislature.

The result, after some negotiation and input from Net companies, is a bill that bars companies from installing software that reports its users' online actions, sends any personal data to other companies, or pops up advertisements without permission. It contains some loopholes: Advertisements served by ordinary HTML or JavaScript are exempted, as are the ordinary "cookies" often used to help personalize Web pages.

The bill also bars "context based" tools from triggering unrelated advertisements based on visiting Web sites on a certain topic, as happened to the contact lens company.

Hackett said she had not seen the final draft of the legislation and that her group could not yet comment.

The Iowa bill focuses more specifically on software that collects user information such as name or e-mail address and transmits it without the person's consent. Two separate California bills have been introduced, one looking specifically at spyware that transmits user information, and the other focusing more broadly on advertising software that uses computer resources without the permission of the PC's owner.

Privacy groups have begun focusing on the problems raised by spyware and adware but have been skeptical of this type of legislative response.

"To us, it makes sense to have a general (federal) privacy bill," said Ari Schwartz, associate director of the Center for Democracy and Technology, a privacy group that has taken a lead in spotlighting spyware dangers. "We've said all along that would help the Internet at large."